diff --git a/internal/routes/routes.go b/internal/routes/routes.go
index 25d9e6f..78f17dd 100644
--- a/internal/routes/routes.go
+++ b/internal/routes/routes.go
@@ -42,7 +42,7 @@ func SetupRoutes(a *app.App) http.Handler {
 	// ====================================================================================
 
 	mux.HandleFunc("GET /auth/onboarding", middleware.RequireAuth(auth.OnboardingPage))
-	mux.HandleFunc("POST /auth/onboarding", middleware.RequireAuth(auth.CompleteOnboarding))
+	mux.HandleFunc("POST /auth/onboarding", authRateLimiter(middleware.RequireAuth(auth.CompleteOnboarding)))
 
 	mux.HandleFunc("GET /app/dashboard", middleware.RequireAuth(dashboard.DashboardPage))